This risk extends even more to non-foss software though as organic fixes can't happen and the company that owns it HAS to fix it for you. Not all purchase agreements say they have to do this, and again it is our organizations that bare the risk then.